diff options
| author | Oliver Neukum <oneukum@suse.com> | 2019-04-30 15:07:36 +0200 |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab+samsung@kernel.org> | 2019-05-22 21:28:41 +0200 |
| commit | 6cf97230cd5f36b7665099083272595c55d72be7 (patch) | |
| tree | 6e7d3a901a9f137fceef94a1fae2c43ea926e96b | |
| parent | media: spi: IR LED: add missing of table registration (diff) | |
| download | linux-6cf97230cd5f36b7665099083272595c55d72be7.tar.xz linux-6cf97230cd5f36b7665099083272595c55d72be7.zip | |
media: dvb: usb: fix use after free in dvb_usb_device_exit
dvb_usb_device_exit() frees and uses the device name in that order.
Fix by storing the name in a buffer before freeing it.
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Reported-by: syzbot+26ec41e9f788b3eba396@syzkaller.appspotmail.com
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
| -rw-r--r-- | drivers/media/usb/dvb-usb/dvb-usb-init.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/drivers/media/usb/dvb-usb/dvb-usb-init.c b/drivers/media/usb/dvb-usb/dvb-usb-init.c index 99951e02a880..dd063a736df5 100644 --- a/drivers/media/usb/dvb-usb/dvb-usb-init.c +++ b/drivers/media/usb/dvb-usb/dvb-usb-init.c @@ -287,12 +287,15 @@ EXPORT_SYMBOL(dvb_usb_device_init); void dvb_usb_device_exit(struct usb_interface *intf) { struct dvb_usb_device *d = usb_get_intfdata(intf); - const char *name = "generic DVB-USB module"; + const char *default_name = "generic DVB-USB module"; + char name[40]; usb_set_intfdata(intf, NULL); if (d != NULL && d->desc != NULL) { - name = d->desc->name; + strscpy(name, d->desc->name, sizeof(name)); dvb_usb_exit(d); + } else { + strscpy(name, default_name, sizeof(name)); } info("%s successfully deinitialized and disconnected.", name); |